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The purposes of the Freedom of Information and Protection of Privacy Act and the 
Municipal Freedom of Information and Protection of Privacy Act are: 


a) To provide a right of access to information under the control of government 
organizations in accordance with the following principles 


° information should be available to the public; 
* exemptions to the right of access should be limited and specific; and 
+ decisions on the disclosure of government information may be reviewed by the 


Information and Privacy Commissioner. 


b) To protect personal information held by government organizations and to provide 
individuals with a right of access to their own personal information. 
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Ce rapport annuel est également disponible en frangais. 


Speaker of the Legislative Assembly 


I have the honour to present my annual report to the Legislative Assembly. This 


report covers the period from January 1, 1995 to December 31, 1995. 
Yours sincerely, 


LTE Wag 


Tom Wright 


Commissioner 
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COMMISSIONER'S MESSAGE 


This 1995 annual report highlights the work of 
the Office of the Information and Privacy 
Commissioner (IPC), reviews the operation of 
Ontario’s access and privacy system and identi- 
fies emerging challenges to freedom of informa- 
tion and the protection of privacy. It tells the 
story of how the access and privacy system is 
responding to the pressures — felt by all public 
sector organizations — to reduce costs, improve 
service and reap the benefits of information 
technology. 


PATH TO ANONYMITY 


One of this year’s most exciting initiatives was 
the publication of a joint report, entitled Privacy- 
Enhancing Technologies: The Path to Anonymity, 
by the IPC and the Dutch Data Protection 
Authority in the Netherlands. This unique 
project illustrates the benefits of international 
co-operation and shows that privacy issues 
transcend national boundaries. 

In modern society the transactions of daily life 
are recorded in minute detail, but the individual 
has little control over data once it has been 
provided. Our report with the Dutch demon- 
strates that if we could minimize personally- 
identifying data, we could have the best of both 
worlds — enjoying the advantages of the informa- 
tion age while restoring privacy to pre-computer- 
era levels. 

The study examined current technologies that 
make anonymous but authenticated transactions 
possible — such as blind signatures, digital pseu- 
donyms and trusted third parties. The analysis 
concluded that these anonymizing privacy- 
enhancing technologies are sound, and should be 
widely adopted. 

The joint paper breaks new ground as a recog- 
nition by data protection authorities that infor- 
mation technology has the potential to contri- 


bute to a golden age of privacy. It is time to stop 
thinking about technology and privacy as mutu- 
ally exclusive — and to start thinking about 
technology as an instrument for raising privacy 
protection to new heights. 

International response to the report has been 
swift, enthusiastic and uniformly positive. The 
report is clearly serving one of its main purposes 
in acting as a catalyst for change in approaches to 
protection of privacy. 


PRIVATE SECTOR DATA PROTECTION 


One key strategy for preserving privacy, then, is 
to engineer privacy values into technology itself. 
Another is to regulate what the private sector 
does with the massive personal databanks now 
compiled in the course of doing business. 

Given the deep public concern about privacy — 
which opinion polls have repeatedly documented 
— it is doubtful Ontarians will be content to leave 
privacy in the marketplace entirely to voluntary 
action. The Canadian Direct Marketing Associa- 
tion understands this, and has called for national 
privacy legislation covering information practices 
in the private sector — the first Canadian business 
group to do so. 

I believe the time is right to establish data 
protection requirements harmonizing with 
international standards, such as the Directive on 
Data Protection recently adopted by the Euro- 
pean Union (EU). In fact, the federal Informa- 
tion Highway Advisory Council is urging a move 
in this direction. The Council has recommended 
that the federal government enact flexible frame- 
work legislation for the private sector. 

This legislation would require private sector 
organizations to comply with the model privacy 
code developed by the Canadian Standards 
Association, while allowing the flexibility to 
determine how to refine their own specific codes. 
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The federal government has also recom- 
mended a legislative framework governing the 
protection of personal data in the private sector. 

It should be noted that the EU directive 
curtails the transfer of personal information to 
non-EU countries lacking adequate data protec- 
tion. EU members have three years from last 
October to bring their laws and regulations into 
compliance with the directive. This deadline 
means that the clock is also ticking for nations 
that want to continue doing business with 
Europe. Unless action is taken soon, the flow of 
information to Ontario could be restricted, 
potentially harming our economic competitive- 
ness. 

National privacy legislation would create a 
uniform standard of data protection. It would 
place all firms on a level playing field, bolster 
consumer confidence in business as a whole, and 
enhance our prospects in global markets. 


ACCOLADES FOR ACCESS 


Let me now turn to access to information. In 
1995 the number of requests for information 
reached an all-time high of more than 26 000 for 
municipal and provincial organizations com- 
bined. 

Provincial government organizations replied to 
about half of requests within 30 days, and an- 
swered nearly three-quarters of requests within 
60 days. Municipal government organizations 
also delivered fast turnaround, responding to 
nine in 10 requests within 30 days. These 
impressive response rates are a tribute to the 
commitment of government organizations and 
the dedicated efforts of the co-ordinators who 
make the system work on a day-to-day basis. 


ACTIVE DISCLOSURE GAINS GROUND 


But in today’s environment — with the public 
expecting better service and lower costs — we 
cannot continue with business as usual. In my 
view the best solution for meeting the public’s 
demand for information in a tough fiscal climate 
is to employ systemic alternatives to the one-off 
processing of requests and appeals. 

For some time I have been advocating two 
options: routine disclosure — in which govern- 
ment organizations pre-classify specific records 
for automatic release in response to a formal or 
informal access request; and active dissemination 
— in which government organizations go farther 
to anticipate customer needs and periodically 
distribute useful general records without waiting 
to be asked. 

Generally, it will be less expensive and less 
time-consuming to release items of interest to 
the public, than to search for specific records in 
response to ad hoc requests. Put simply, routine 
disclosure and active dissemination make access 
to information faster, easier and cheaper. 

Furthermore, there is a philosophical question 
here. Ultimately, I do not believe Ontarians will 
be satisfied with the piecemeal release of infor- 
mation on request. After all, government-held 
information really belongs to the citizenry; 
government is merely the custodian. The true 
purpose of freedom of information legislation is 
to change the culture of government organiza- 
tions — to foster a spirit of openness and a readi- 
ness to share information with the public as an 
ongoing part of doing business. 

I find it heartening that these alternative 
practices are gaining momentum among provin- 
cial and municipal organizations. To cite just 


one of a host of examples, the North York Board 


of Education has published in-depth profiles of 
each of its schools in both 1995 and 1996. 

These plain-language reports present the 
school’s results in standardized tests, as well as a 
summary of results across the system for pur- 
poses of comparison. Also included is a portrait 
of the student body and information on the 
school’s programs and plans for improvement. 
The release of these innovative profiles sets a 
high standard of accountability to taxpayers and 
parents for the performance of our schools. 

At the IPC we try to practice what we preach. 
In November 1995 we launched our own web 
site on the Internet as an information source on 
virtually everything we do. Our system includes 
tools ranging from a plain language guide to the 
provincial and municipal freedom of informa- 
tion and protection of privacy acts, to summaries 
of policy papers, to indices of orders and investi- 
gation reports. The full text of orders, published 
investigation reports and policy papers is avail- 
able through downloading. We have received 
strong positive feedback on the convenience of 
on-line access to this bank of useful information. 


CHIEF INFORMATION OFFICER 
FUNCTION 


As Ontario moves to the forefront in the devel- 
opment and application of information techno- 
logy, I believe the time has come for the Ontario 
government to more formally adopt a model 
commonly found in the private sector, and 
increasingly in other jurisdictions. 


COMMISSIONER'S MESSAGE 


I refer to explicitly recognizing the role and 
mandate of a chief information officer, which 
would signal the importance of managing infor- 
mation across the corporation that is the govern- 
ment of Ontario. 

Ontario has already demonstrated a commit- 
ment to enhancing public access to information 
through the use of technology. The formal 
establishment of a chief information officer 
function would produce many benefits, such as 
facilitating private sector understanding of the 
role of government in this important area, 
providing a focal point for partnerships with the 
private sector and other jurisdictions, and encour- 
aging continued commitment across government 
to access and privacy principles. 


TEAMWORK HAILED 


No review of the year’s achievements would be 
complete without a salute to the people who 
made them happen — the staff of the IPC, who 
each year take the IPC to new levels of accom- 
plishment, the access and privacy group at 
Management Board Secretariat, and the informa- 
tion and privacy co-ordinators in provincial and 
municipal organizations. I look forward to 
working with these committed and talented 
individuals in the year ahead to attain further 
strides in customer service and the productive 
use of taxpayers’ resources. 


Tom Wright 


Information and Privacy Commissioner 


The Information and Privacy Commissioner 


performs duties under two pieces of legislation: the 
Freedom of Information and Protection of Privacy Act 
(the provincial Act) which took effect in 1988 and 
the Municipal Freedom of Information and Protec- 
tion of Privacy Act (the municipal Act) which took 
effect in 1991. Together, these two Acts constitute 
an overall legislative scheme embracing both 
freedom of information and protection of privacy. 

The provincial Act applies to all Ontario govern- 
ment ministries and most provincial agencies, 
boards and commissions, as well as to colleges of 
applied arts and technology and district health 
councils. The municipal Act covers local govern- 
ment organizations — such as municipalities; police, 
library, health and school boards; and public 
utilities and transit commissions. 

Freedom of information refers to public access 
to general records about what government does, 
ranging from administration and operations to 
legislation and policy. The underlying objective is 
open government, to hold elected and appointed 
officials accountable to the people they serve. 

Privacy protection refers to the safeguarding of 
personal information — that is, data about identifi- 
able individuals — held by government organiza- 
tions. The Acts establish rules about how govern- 
ment organizations may collect and use personal 
data. In addition, individuals have the right to 
examine their own personal information and 
correct it if necessary. 

The basic premise underlying the Acts is that 
government is the custodian, not the owner, of the 
information it possesses. The true owner of general 
government information is the public collectively. 


And the true owner of personal information is the 
individual to whom the information relates. 

The Aczs establish an independent agency — the 
Office of the Information and Privacy Commis- 
sioner or the IPC — to review government decisions 
on access to information as well as government 
data protection practices. To ensure impartiality, 
the Commissioner is appointed by and accountable 
to the Legislative Assembly — not the government 
of the day. 

In fulfilling its mandate, the IPC plays several 


major roles: 


* resolving appeals filed when government organi- 
zations refuse to grant access to information; 


* investigating privacy complaints about govern- 
ment-held information; 


* ensuring that government organizations comply 
with the Acts; 


* conducting research on access and privacy issues 
and providing advice on proposed government 
legislation and programs; and 


* educating the public about Ontario’s access and 
privacy laws. 


In accordance with the legislation, the Commis- 
sioner has delegated some of his decision-making 
powers to his staff. The Assistant Commissioner 
(Access) and six Inquiry Officers have the authority 
to issue orders resolving appeals. The Assistant 
Commissioner (Privacy) investigates privacy 
complaints, reviews government practices, approves 
applications for indirect collection of personal 
information and comments on computer matching 
proposals by the provincial government. 
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Government organizations, both provincial and 
municipal, file a yearly report with the IPC on 
their activities under the Acts. These reports in- 
clude data on the requests received for general 
records, personal information and correction of 
information, as well as on the organizations’ 
response to these requests. By compiling these 
reports, the IPC gains a useful picture of compli- 
ance with the Acts. 

Provincial government organizations received a 
total of 11 645 requests for information in 1995, 
down slightly from the previous year. Municipal 
government organizations received a total of 
14 671 requests, up sharply from the record 
10 238 requests received the previous year. This is 
also the first year that requests to municipal organi- 
zations outnumbered requests to provincial organi- 
zations. 

Requests for access to general records outnum- 
bered requests for access to personal information 
by about two to one. The proportions differed for 
provincial and municipal organizations with 
general records requests outnumbering personal 
information requests more than three to one for 
provincial organizations and about 1.4 to one for 
municipal organizations. 

Once again the vast majority of requests received 
by both the provincial and municipal organizations 
were completed by year end. Only eight per cent of 
requests were carried over to 1996. 

The Ministry of Finance again reported the 
highest number of requests under the provincial 
Act, followed by the Ministry of the Solicitor 
General and Correctional Services, the Ministry of 
Labour and the Ministry of Environment and 
Energy. Together these four Ministries accounted 
for 62 per cent of all provincial requests. 

Under the municipal Act, police services boards 
received 48 per cent of total requests. Municipal 
corporations (including municipal governments) 
were next with 35 per cent, followed by school 
boards with seven per cent and public utilities with 
four per cent. 


INFORMATION REQUESTS PROFILED ACROSS GOVERNMENT 


Requests Received and Completed — 1995 
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Forty-seven per cent of provincial requests were 
answered within 30 days in 1995. Seventy-four per 
cent of 1995 requests were completed within 60 
days, while only seven per cent took more than 
120 days. 

Municipal government organizations responded 
to a sizable majority of requests — 90 per cent — 
within 30 days in 1995. This was the fifth consecu- 
tive year at virtually the same high level. Ninety- 
seven per cent of municipal requests in 1995 were 
answered within 60 days, with less than one per 
cent taking more than 120 days to complete. 

As to outcomes, 44 per cent of provincial re- 
quests completed in 1995 led to the release of all 
information sought. For municipal requests, this 
climbed to 56 per cent leading to full disclosure. In 
only one in seven cases was no information 
released. 

Under the exemption provisions of the Acts, 
government organizations can, and in some cases 
must, refuse to disclose requested information. 
Following the pattern of the past several years, in 
1995 both provincial and municipal organizations 
cited personal privacy and personal information 
exemptions most frequently. 
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Provincial Exemptions Used 


General Records — 1995 


Section 13 — Advice to 
Government 226 (9.2%) 


Section 14 — Law 
Enforcement 295 (12.1%) 


Other — 930 (37.9%) 


Section 21 — Personal 
Privacy 1001 (40.8%) 


Municipal Exemptions Used 
General Records — 1995 


Section 10 — Third Party 
Information 224 (6.8%) 


Section 14 — Personal 


Privacy 1549 (47.4%) SEAT EE) 


Section 8 — Law 
Enforcement 826 (25.3%) 


Provincial Exemptions Used 


Personal Information — 1995 
Section 17 — Third Party 
Information 56 (5.6%) 


Section 49 — Personal 
Information 594 (59.3%) 


Section 14 — Law 
Enforcement 160 (15.9%) 


Other — 192 (19.2%) 


Municipal Exemptions Used 
Personal Information — 1995 


Section 10 — Third Party 
Information 135 (6.7%) 


Section 38 — Personal 


< Other — 349 (17.2%) 
Information 1063 (52.5%) 


Section 8 — Law 
Enforcement 478 (23.6%) 


Under the legislation, individuals have the right 
to request correction of their personal information 
held by government. This year provincial organiza- 
tions received 13 correction requests and refused 
three of them. Municipal organizations received 
146 correction requests — only about a third as 
many as last year — and refused only 21 of them. 
When correction is refused, the requester may 
attach a statement of disagreement to the record, 
outlining why the information is felt to be incor- 
rect. This year no provincial and only seven muni- 
cipal statements of disagreement were filed. 

The legislation permits government organiza- 
tions to charge fees for providing access to infor- 
mation under certain conditions. A fee estimate 
must be provided before filling the request where 


INFORMATION REQUESTS PROFILED ACROSS GOVERNMENT 


the expected charge is over $25. Organizations 
have discretion to waive payment where it seems 
fair and equitable to do so after weighing several 
specific factors. In addition, people cannot be 
required to pay fees for access to their own personal 
information. 

As in previous years, provincial organizations 
most often cited reproduction of material as the 
reason for collecting fees in 1995. Reproduction 
costs were mentioned in 47 per cent of cases where 
fees were collected, followed by preparation costs 
in 42 per cent and shipping costs in eight per cent. 
Municipal organizations cited reproduction costs 
in 39 per cent of cases where fees were collected, 
other (invoice costs) in 21 per cent and preparation 
in 19 per cent. 


PROVIDING AN AVENUE OF APPEAL. 


A key feature of Ontario’s access and privacy 
system is the right to appeal government decisions 
under the Acts to the IPC. Appeals can be lodged 
concerning denial of access to general records or 
personal information, refusal to correct personal 
information, the imposition of fees or other aspects 
of the processing of an information request. 

Before launching a formal inquiry, the IPC first 
attempts to settle the case through mediation. If a 
settlement is not reached within a reasonable time 
period, we conduct an inquiry and issue a binding 
order to resolve the appeal. 


Further Productivity Gains 


The efficient processing of appeals remains a top 
priority at the IPC, to improve customer service 
and make better use of resources. In 1995 we 
closed eight per cent more appeals and issued 20 
per cent more orders than in 1994. 

We also resolved appeals more quickly. During 
the year we closed 88 per cent of appeals within 
five months of receipt, up from 82 per cent within 
five months in 1994 and 66 per cent in 1993. The 
average time to close an appeal continued to 
decline — to 3.3 months this year from 3.6 months 
last year and 5.4 months in 1993. 

During 1995 we applied the procedures tested 
over the previous two years through our Innova- 
tion Pilot Project to all appeals entering the system. 
Under this new approach we have established more 
structured time frames for various stages in the 
appeal process. For example, an inquiry automati- 
cally begins if an appeal has not been settled in just 
over two months. This deadline can lend impetus 
to mediation efforts, which often continue after the 
notice of inquiry has been issued. 

Experience shows mediated settlements require 
fewer resources and generally produce more satis- 
factory results for both appellants and organiza- 
tions. This year we formed an internal working 
group to study how mediation works in other 


Ontario government agencies and in access and 
privacy commissions in other provinces. We are 
applying what we learned by developing a new in- 
house staff training course, providing clients with 
more information on mediation’s benefits, and 
considering more emphasis on face-to-face meet- 
ings rather than telephone contacts. 


Appeals: Statistical Trends 


A total of 1526 appeals’ were filed with the IPC in 
1995 — down one per cent from the previous year. 
For the first time, appeals under the municipal Act 
exceeded those under the provincial Act. Muni- 
cipal appeals increased seven per cent from the 
previous year to 774, while provincial appeals 
decreased eight per cent to 752. 

Eighty-four per cent of provincial appeals this 
year involved ministries rather than agencies, while 
51 per cent of municipal appeals concerned 
municipal corporations, followed by police services 
boards and boards of education. These patterns are 
similar to those recorded in prior years. 


Appeals Received — 1988-1995 
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an additional 741 inactive appeals were received during 1991 


Municipal 
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XX 


an additional 129 inactive appeals were received during 1992 


XX 


an additional 28 inactive appeals were received during 1993 


' The statistics cited in this annual report refer to active appeals only, unless otherwise indicated. In 1991, the IPC established a policy of limiting the number of 
appeals, from any one source, worked on at one time. This policy was necessary to deal with bulk use of the appeal process. Active appeals are those that were 
actively worked on by the IPC during the year. All other appeals are classified as inactive. 


During 1995 the IPC closed 1595 appeals. As in 
the previous year, the total was almost evenly split 
between the two Acts, with provincial organizations 
accounting for 51 per cent of cases resolved and 
municipal organizations 49 per cent. Provincial 
and municipal appeals closed were up by nine and 
eight per cent, respectively. 

We resolved 36 per cent of all appeals closed this 
year by issuing an order, compared with 32 per 
cent last year. The trends under the two Acts were 
similar: 36 per cent of provincial and 35 per cent 
of municipal cases were closed by order this year. 

In all, the IPC issued a total of 507 orders in 
1995. The provincial-municipal breakdown was 
similar to 1994’s — with 52 per cent of orders 
concerning provincial government organizations 
and the remaining 48 per cent, municipal. (The 
number of orders is less than the number of ap- 
peals closed by order, since an order may deal with 
more than one appeal.) 


Orders Issued — 1988-1995 
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Among appeals closed by order, the decision of 
the government organization was fully upheld in 
47 per cent of cases this year, virtually unchanged 
from 46 per cent last year. The organization’s 
decision was partly upheld in 36 per cent of ap- 
peals, up from 31 per cent, and not upheld in 11 
per cent of cases, down from 20 per cent. 


Municipal 


PROVIDING AN AVENUE OF APPEAL 


A mediated settlement was achieved in 62 per 
cent of appeals resolved this year, an increase from 
59 per cent last year. In all, nearly a thousand cases 
were successfully mediated in 1995. 


Outcome of Appeals Closed by Order 
Provincial — 1995 


Other 14 (4.7%) 


Head's Decision Not 
Upheld 27 (9.1%) 


Head's Decision 
Upheld 153 (51.5%) 


Head's Decision Partly 
Upheld 103 (34.7%) 


Outcome of Appeals Closed by Order 
Municipal — 1995 


— Other 16 (5.9%) 


Head's Decision Not 
Upheld 37 (13.7%) 


Head's Decision 
Upheld 115 (42.6%) 


__ Head's Decision Partly 
Upheld 102 (37.8%) 


Outcome of Appeals Closed Other Than by Order 
Provincial — 1995 


Abandoned 7 (1.4%) 
Withdrawn 13 (2.5%) 
Non-jurisdictional 0 (0.0%) 


Settled 498 (96.1%) 


Outcome of Appeals Closed Other Than by Order 
Municipal — 1995 
——— —— Abandoned 7 (1.4%) 


— Withdrawn 12 (2.3%) 
Non-jurisdictional 0 (0.0%) 


Settled 491 (96.3%) 
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Highlights of Orders 


Below are brief summaries of some of the key 
orders issued by the IPC in 1995. 


ABUSE OF PROCESS CONTROLLED 


In December 1994 the boards and chiefs of four 
police forces applied for a court injunction against 
the IPC and two individuals who had filed a large 
number of information requests over a period of 
about two years. The requesters had sought access 
to information ranging from washroom cleaning 
schedules in police stations, to a detailed listing of 
arrests over a five or 10 year period, to UFO 
sightings. Such unrelated requests were often 
duplicated among different police forces. 

The court application claimed that the requests 
were frivolous, vexatious and an abuse of the right 
of access provided in the municipal Act. The case 
was put on hold to allow the IPC to conduct an 
inquiry into the subject of frivolous or vexatious 
requests. 

Five appeals involving one of the requesters were 
included in the inquiry. We invited interested 
parties to intervene and in late August we held a 
public hearing. Following a full review of the 
matter, the Commissioner released an order resolv- 
ing the case on October 18. 

In his decision the Commissioner declared the 
requester to be engaged in a course of conduct that 
constituted an abuse of the processes of govern- 
ment institutions and the Commissioner’s office. 
The order imposed conditions on the processing of 
any requests and appeals from him currently and 
for a specified period into the future. The Com- 
missioner concluded that the Act as then written 
did not relieve an institution from the obligation to 
respond to frivolous or vexatious requests. 

In the order the Commissioner stressed that a 
distinction exists between a statutory right and the 
means available to realize it. He held that while the 
requester in principle may have an unlimited right 
of access to government information, subject only 
to the exemptions set out in the Act, he does not 
have unlimited access to the processes available to 


2 This order was under judicial review at the time of writing. 


secure that right. The excessive number of requests 
and appeals, coupled with their varied nature and 
broad scope as well as other factors, led to the 
finding of abuse of process. 

The conditions imposed in the order were 
designed to maintain the requester’s right of access 
to information while preventing further abuse. The 
conditions include: 


* no government institution, covered by either the 
provincial or municipal Act, was required to 
process any of his requests or appeals for the next 
60 days — until December 17, 1995; 


¢ the number of requests and/or appeals he can 
have at any one time over the following 12 months 
— until December 17, 1996 — is limited to five; 


* no individual government organization will be 
required to process any more than one of his 
requests and/or appeals at a time, to a maximum of 
four requests and/or appeals during the year; 


¢ after the 12 months, any person or organization 
affected by the order can apply to have it varied; 
otherwise its terms and conditions will continue 
from year to year. (Order M-618°) 


PUBLIC INTEREST OVERRIDESAPPLIED 


The Ministry of the Attorney General received a 
request from a newspaper reporter for all records 
concerning the establishment of a local area net- 
work in the Ministry s Computer and Telecommu- 
nications Branch. More specifically, the requester 
sought information pertaining to a named indivi- 
dual, including his job classification and work 
duties, the company through which he was hired, 
his access to Ministry computer records, the 
circumstances of his hiring and termination and 
other matters. 

When the Ministry refused to confirm or deny 
the existence of the records sought, the reporter 
appealed and claimed there was a compelling 
public interest in disclosure. He alleged that the 
hiring of the named individual amounted to a 
breach of security and placed the integrity of a 


sensitive area of the Ministry at risk. 


The IPC ruled that disclosure of the mere 
existence of the records would not result in an 
unjustified invasion of personal privacy, and went 
on to confirm their existence. In reviewing the 
contents of the records, we found that some 
contained personal information whose release 
would constitute an unjustified invasion of privacy. 
We then turned to the public interest override in 
section 23 of the provincial Act (section 16 of the 
municipal Act), and considered whether there was a 
compelling public interest in the disclosure of any 
of these records that clearly outweighed the pur- 
pose of the privacy exemption. 

In our view the public interest in disclosure 
should be measured in terms of the Act’s central 
purpose of shedding light on the operations of 
government. In this case, serious questions had 
been raised about the possibility of a security risk 
and the appropriateness of the Ministry’s actions. 
In our view portions of a critical issue sheet - a 
briefing note prepared by the Ministry - would 
contribute the public’s understanding of the 
activities of government. 

We therefore ordered disclosure of the relevant 
portions of the critical issue sheet, despite the 
impact on privacy. This was the first occasion the 
IPC has applied the override in section 23. (Order 
P-984) 


DIMINISHED PRIVACY RIGHTS 
OF PUBEIC FIGURES 


The Ministry of Citizenship, Culture and Recrea- 
tion received a request for access to records regard- 
ing its involvement in efforts to stop the perform- 
ance of the musical Show Boat. The Ministry 
located the responsive records and denied access to 
most of them, in whole or part. 

The Ministry justified its decision on the 
grounds that some of the records contained advice 
or recommendations to government, while disclo- 
sure of others would constitute an unjustified 
invasion of personal privacy. The notice of inquiry 
was sent to 41 individuals mentioned in the 
records, six of whom made representations. 

The IPC determined that certain records did in 
fact contain advice or recommendations. Other 


PROVIDING AN AVENUE OF APPEAL 


records contained personal information — specifi- 
cally, on individuals’ race, ethnic origin or religion 
— whose disclosure would constitute an unjustified 
invasion of personal privacy. 

However, other information about individuals 
could not be characterized as personal, as the 
references to these individuals denoted their 
professional rather than personal status. The names 
of some individuals appeared in the context of 
their job responsibilities, while others were men- 
tioned in their capacities as politicians, publicly 
elected officials, community leaders or members of 
the media. 

In the IPC’s view people in such positions 
necessarily decide to forego an element of their 
personal privacy when they take a stand on issues 
or attend events covered by the media. Under such 
circumstances it is not reasonable to expect the 
identities of these individuals to be kept confiden- 


tial. (Order P-978) 


ACCESS TO LAWYER’S RECORDS 


An employee of The Thunder Bay Hydro Com- 
mission (Hydro) asked Hydro for access to all 
records relating to an investigation of herself and a 
former employee. The requester also sought com- 
munications between Hydro and the investigating 
lawyer, all statements made by those interviewed 
by the lawyer, and a copy of her personnel file. 
Hydro allowed the requester access to her person- 
nel file and Hydro Commission meeting minutes, 
but denied access to other requested records. The 
requester appealed. 

During mediation, Hydro agreed to provide access 
to other requested records, but not the lawyer’s 
investigation records, claiming that it did not have 
custody or control of these records and, hence, the 
records were not subject to the municipal Act. 

The IPC addressed two issues. First, we found 
that Hydro did not have actual custody of the 
records held by the lawyer. The remaining question 
was whether any responsive records in the custody 
of the lawyer were under the control of Hydro. 

Upon consideration of the appropriate factors, 
the IPC upheld Hydro’s position that the records 
were the property of the lawyer and Hydro did not 
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have control over them, therefore the records could 
not be subject to an access request under the Act. 
In a postscript to the order, we identified the 
importance of retaining the right of access to infor- 
mation in situations where a government organiza- 
tion has decided to contract out services it used to 
deliver directly. Ata minimum, any agreement 
with an outside contractor should stipulate that the 
government organization retains control over 


records for purposes of the Act. (Order M-506) 


ACCESS TO EXPENSE ACCOUNTS 


A taxpayer organization asked the Board of Educa- 
tion for the City of York to provide a breakdown 
of expenses by eight trustees over a period of about 
two and a half years, and a copy of the Board’s 
cheque register for three and a half years. The 
requester appealed the Board’s fee estimates, which 
were subsequently reduced to $756 and $349, 
respectively. 

The IPC upheld the revised fees, as the amounts 
had been calculated in accordance with the provi- 
sions of the municipal Act. In a postscript to the 
order, however, the Commissioner commented on 
the growing public interest in expenditure-related 
records. He acknowledged that while the Acts 
contemplate a user-pay principle for access to 
general records, this principle must be applied 
flexibly, taking into account the nature of informa- 
tion sought and the frequency of particular types of 
requests. 

In the Commissioner’s view, it is time for all 
government organizations to make expenditure- 
related information routinely available to the 
public — including expenses incurred by senior 
officials for which they will be reimbursed by the 
organization. In fact, this “routinely available” 
approach is equally relevant to all non-exempt 
general records held by government, the Commis- 
sioner wrote. Put simply, routine disclosure makes 
public access to information faster, easier and 


cheaper. (Order M-583) 


Mediation Gets Results 


A solid majority of all appeals are resolved volun- 
tarily, through mediation. Here are a few examples 
of the constructive role played by IPC appeals 
officers in assisting the parties to find common 
ground. 


CONCERNS ADDRESSED 


The appellant, who was having problems with the 
landlord of a local trailer park, requested a copy of 
a Ministry of Housing report relating to the land- 
lord. A request was also made for background 
documents to the report. The Ministry denied 
both requests. 

An appeal was filed and, through the efforts of 
the appeals officer, during mediation the Ministry 
representative proposed a meeting with the appel- 
lant. The meeting was designed to try and resolve 
the substantive concerns underlying the access 
requests. The meeting was positive and the Minis- 
try was able to address the appellant’s concerns 
regarding the landlord. As a result, the case was 
settled. 


REQUESTS CONSOLIDATED 


When four individuals sought similar law enforce- 
ment records, a regional police force requested 
time extensions to locate the responsive items. The 
individuals appealed these decisions. During 
mediation the IPC appeals officer discovered that 
the four requesters were acquainted, and convinced 
them to combine their requests and have one of the 
four act as their common representative. The 
police found the consolidated request easier to 
process and agreed to issue a decision letter more 
quickly. As a result the requesters agreed to close 


‘their appeals. 


CONFIDENTIAL SOURCES PROTECTED 


An individual who was unsuccessful in obtaining a 
job with a police force asked for a copy of a back- 
ground check performed by the police. The force 
denied access, arguing that even if the names of 
the people who supplied background information 
were removed, the remainder of the records could 
still reveal their identities. 

With the permission of the police, the appeals 
officer selected certain descriptive phrases in the 
background notes and provided them to the 
requester. These phrases included “not outgoing”, 
“performs poorly” and “no confidence”. The 
requester was satisfied with the degree of disclosure 
and withdrew the appeal. 


Judicial Review Cases 


Like decisions of other administrative tribunals, 
orders by the Information and Privacy Commis- 
sioner may be reviewed by the courts on jurisdic- 
tional grounds. During 1995, 11 new applications 
for judicial review were filed and 19 cases were 
resolved. Of the 19, 10 were withdrawn, six were 
dismissed and three were allowed. Twenty-one 
applications remained before the courts at year 
end. 


LATE EXEMPTION POLICY UPHELD 


In one court case decided this year, a brewing 
company sought records from the Ministry of 
Consumer and Commercial Relations on service 
charges and user fees levied by Brewers Retail Inc. 
The requester also sought related documents on 


PROVIDING AN AVENUE OF APPEAL 


the settlement of the beer trade dispute between 
the United States and Canada. 

The Ministry granted access to some records but 
denied it to others — claiming exemptions for 
Cabinet records, advice to government, intergov- 
ernmental relations, third party information, 
valuable government information and solicitor- 
client privilege. The requester appealed. 

The IPC sent the Ministry a confirmation of 
appeal in June 1994 setting out the IPC’s policy on 
raising additional exemptions in the course of an 
appeal. Under this policy, an organization has 35 
days from the date of the confirmation to raise 
additional discretionary exemptions. The policy 
was established in an /PC Practices bulletin issued 
in January 1993. 

In representations in December 1994 the Minis- 
try raised several more exemptions for the first 
time. The Ministry gave reasons for some of the 
new claims, but offered no explanation for the six- 
month delay in bringing them to the IPC’s atten- 
tion. The IPC rejected the Ministry’s submissions 
that the 35-day time limit should not apply in this 
appeal, and refused to consider the additional 
exemptions. (Order P-883) The Ministry then 
applied for judicial review, challenging this deci- 
sion as a denial of natural justice and raising still 
more exemptions for the first time. 

The Divisional Court dismissed the Ministry’s 
application”. On the exemptions claimed for the 
first time in the judicial review proceeding, the 
Court held that “there is a necessary implication 
that the head chose to exercise discretion against 
claiming an exemption when it was not claimed 
earlier in the proceedings.” 

On the issue of the 35-day time limit, the Court 
held that the government had received ample 
notice of this policy. As well, the Ministry had the 
opportunity to make submissions on why late 
exemptions should be considered, but did not do 
so in a satisfactory manner. The Court confirmed 
that the purpose of the 35-day policy was to 
provide a “window of opportunity” to institutions 
to raise new discretionary exemptions without 
compromising the integrity of the IPC’s process. 

The Ministry has sought leave to appeal this 
judgment to the Ontario Court of Appeal. 


> Ministry of Consumer and Commercial Relations v. Anita Fineberg, Inquiry Officer et al. (21 December 1995), Toronto Doc. 220/95 (Ont. Div. Ct.), leave to appeal 


filed January 4, 1996. 
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DOCUMENT PRODUCTION 
POWERS CONFIRMED 


In another case this year, the Ministry of Health 
received a request from the victim of a stabbing for 
access to information about her assailant’s deten- 
tion and release from a psychiatric hospital. The 
assailant had been held in the hospital after being 
found not guilty by reason of insanity on two 
counts of attempted murder. The Ministry denied 
the request, on the grounds that the records at 
issue were psychiatric records which fell outside the 
scope of the Act. 

The IPC found that while certain defined types 
of psychiatric records are not covered by the Act, 
the question of whether particular records satisfy 
the definition is properly the subject of an appeal. 
Accordingly, the IPC must have authority to 
compel the Ministry to produce records for inspec- 
tion, so the IPC can determine this issue independ- 
ent of the government’s initial decision. 

On judicial review, the Divisional Court agreed 
with the IPC. Neither the exclusion of certain 
defined records from the scope of the Act, nor the 
confidentiality provisions of the Mental Health Act, 
precluded the IPC from inspecting the records in 
order to determine the threshold question of its 
jurisdiction to conduct an inquiry. 

On appeal by the Ministry, the Court of Appeal 
also upheld the IPC’s power to order the govern- 
ment to produce records for inspection.” The 
Court confirmed that the IPC’s production powers 
“must be construed as being applicable to all 
inquiries conducted pursuant to the Act.” 


* Ontario (Minister of Health) v. Holly Big Canoe, [1995] O.J. No. 2477 (C.A.), affirming (29 June 1994), Toronto Doc. 111/94 (Div. Ct.) 


To protect individual privacy, the Acts establish 
rules for the collection, retention, use, disclosure, 
security and disposal of personal information held 
by government organizations. People who believe a 
government organization has failed to comply may 
complain to the IPC. We investigate the com- 
plaint, try to mediate a solution and, if necessary, 
make formal recommendations to the organization 
to revise its practices. 

A few IPC investigations are prompted by 
appeals. That is, we may decide to examine an 
organization’s procedures if problems become 
apparent during an appeal proceeding. 

The IPC also works to ensure adherence to the 
legislation by conducting compliance reviews, 
which examine the information management 
practices of targeted government organizations. We 
sometimes comment on specific problems or 
circumstances that come to our attention outside 
the context of an investigation or review. In addi- 
tion, we comment on the privacy aspects of com- 
puter matching proposals by provincial govern- 
ment organizations. 


SAFEGUARDING PERSONAL INFORMATION — 


More Investigations Completed 


The IPC completed 234 investigations in 1995, up 
10 per cent from 1994. This figure reflects a 31 per 
cent increase in the number of municipal investiga- 
tions, coupled with a four per cent decrease on the 
provincial side. Overall, we found a breach of the 
legislation in 21.4 per cent of all cases investigated, 
down from 28.3 per cent last year. 


Number of Privacy Investigations Completed 
1988-1995 
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* includes 9 provincial investigations in 1993, 11 in 1994 and 
11 in 1995 that were discovered to involve non-jurisdictional 
organizations or issues during the course of the investigation 
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Privacy Investigations Completed 
by Outcome — 1995 


Provincial 
Breached Complied 
the Act with the Act 
Not Unable to 
Personal Conclude** 
Information 


* includes 11 provincial investigations that were discovered to 
involve non-jurisdictional organizations or issues during the 
course of the investigation 


** includes 29 investigations where the complainant abandoned or 


withdrew their complaint during the course of the investigation 


The IPC attempts to resolve investigations 
through mediation and voluntary settlement, 
without a formal report. This approach saves 
resources and improves customer service. 

In 1995 we issued 27 formal investigation 
reports compared with 45 in 1994. Only about 
one case in 10 was closed by a formal report this 
year, compared with one in five last year. 

More than three-quarters of complaints resolved 
in 1995 were settled informally or through media- 
tion. In about one case in seven, the government 
organization involved accepted an IPC request to 
take action to settle a complaint voluntarily. In a 
further one-seventh of cases, we made suggestions 
on practices and procedures to an organization 
during mediation. And in nearly half of all cases, 
we found that the government organization was 
either in compliance with the Acts or had already 
taken corrective action. 

The average time to complete an investigation 
started in 1995 was 1.8 months — comparable to 
the improved level of 1.9 months recorded over the 
previous two years. At year end, only four per cent of 
complaints in the system were more than four months 
old — down from 10 per cent at the end of 1994. 


Privacy Investigations Completed 
by Type of Resolution — 1995 
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* includes 11 provincial investigations that were discovered to 
involve non-jurisdictional organizations or issues during the 
course of the investigation 


The disclosure of personal information was at 
issue in more than six in 10 investigations com- 
pleted in 1995, in line with previous years. The 
collection of personal information was the next 
most frequent issue, accounting for one in five 
investigations this year. 


Privacy Investigations Completed by Issue* 
Provincial — 1995 


Personal Information 
Bank 1 (0.8%) 


Security 2 (1.7%) 
Access 3 (2.5%) 


Use 4 (3.3%) Retention 5 (4.1%) 


Disclosure 79 (65.3%) Collection 27 (22.3%) 


* includes 11 investigations that were discovered to involve non- 
jurisdictional organizations or issues during the course of the 
investigation 


Privacy Investigations Completed by Issue 
Municipal — 1995 


Personal Information 
Bank 1 (0.9%) 


Use 2 (1.8%) 


Retention 5 (4.4%) Access 12 (10.6%) 


Disclosure 72 (63.7%) Collection 21 (18.6%) 


The principal user of the complaints system is 
the general public. Members of the public filed six 
in 10 complaints closed by the IPC in 1995, 
similar to the 1994 level. 

This year, 42 per cent of municipal complaints 
were submitted by an employee of the government 
organization involved — an increase from 23 per 
cent the year before. About one-quarter of provin- 
cial complaints were filed by employees in each of 
the two years. 


Type of Complainants Involved in 
Privacy Investigations — 1995 


Provincial 


Municipal 
Member of Employee 
the Public* of Institution 
Group 
Complaint a mes 


* includes 11 provincial investigations that were discovered to 
involve non-jurisdictional organizations or issues during the 
course of the investigation 


ORAL COMPLAINTS 
CONTINUE UPSWING 


In addition to dealing with written complaints, the 
IPC responds to privacy concerns or complaints 
lodged over the telephone. In 1995 we resolved 
533 oral complaints — an increase of 85 per cent 
from 1994 and more than triple the level recorded 
114998; 


SAFEGUARDING PERSONAL INFORMATION 


Highlights of Investigations 


The following are short sketches of some of the key 
investigation reports released by the IPC this year. 


OVERPAYMENT REQUEST 
INCORRECTLY ADDRESSED 


The complainant received a letter requesting her to 
repay an overpayment under the Family Benefits 
Act (FBA), but she was not the person for whom 
the letter was intended. While the complainant’s 
last name was the same, her first name was slightly 
different. The municipality where the request 
originated had asked the Ministry of Transporta- 
tion to search its databases for addresses listed for 
individuals with the complainant’s last name. The 
municipality had then incorrectly matched the 
complainant’s address with the FBA recipient’s 
name. Even after pointing out the error, the 
complainant received two more letters intended for 
the benefit recipient. 

Section 30(2) of the municipal Act requires an 
institution to take reasonable steps to ensure that 
personal information is not used unless it is accu- 
rate and up to date. We found that the municipal- 
ity did not comply with this section before at- 
tempting to recover the overpayment. We were 
also concerned that the benefit recipient’s personal 
information had been improperly disclosed when 
the complainant received the letters containing the 
benefit recipient’s full name, case number and the 
amount of the overpayment. 

In response to the complaint, the municipality 
took extensive proactive measures to prevent future 
errors, including a revision of its procedures for 
handling search information, a retroactive audit of 
information received from the Ministry of Trans- 
portation, and further employee training. We 
recommended that the municipality share these 
measures with other municipalities to assist them 
in implementing similar steps to ensure that 
personal information in their custody is accurate 
and up to date. (Investigation 195-031M) 


Lik: 


20 ANNUAL REPORT 1995 


PSYCHIATRIC RISK ASSESSMENT 
UNWARRANTED 


A former community college nursing student filed 
a complaint with the IPC when he discovered that 
the college had asked a psychiatric institute for a 
“risk assessment” of his potential for violence. 

During his time as a student, the complainant 
had been overheard making threatening comments 
relating to his studies. He apologized for his 
behaviour but later wrote to an instructor com- 
plaining that he was being harassed and discrimi- 
nated against. He subsequently left the college and 
initiated a series of legal proceedings against the 
college. 

More than two years later, upon reviewing his 
file at a psychiatric institute where he was a patient, 
the complainant found a letter from the college 
requesting the risk assessment, with a copy of his 
letter to the instructor attached. 

We found that the college’s collection of per- 
sonal information about the complainant was not 
in compliance with section 38(2) of the provincial 
Act. Contrary to the college’s view, the Occupa- 
tional Health and Safety Act could not be inter- 
preted as explicitly authorizing the collection of the 
risk assessment, nor was the collection used for law 
enforcement purposes. While we agreed that 
dealing with existing and pending litigation was a 
lawfully authorized activity, it was our view that 
the risk assessment was not necessary to the proper 
administration of this activity. 

In addition, we found that the college’s disclo- 
sure to the psychiatric institute of the complain- 
ant’s letter to the instructor was a breach of section 
42 of the Act. The college cited section 42(c), 
“consistent purpose”, for its disclosure. However, it 
was our view that since the college had collected 
the complainant’s letter in order to deal with the 
issues he had raised, the complainant could not 
reasonably have expected that his letter would later 
be sent to the institute with the college’s request 
for a risk assessment. (Investigation 195-030P) 


TAX ARREARS DISCLOSED 


An individual complained that a township had 
disclosed details of his outstanding property taxes, 
arrears, penalties and tile drainage loan payments 
due, at a special council meeting. Under section 27 
of the municipal Act, the privacy protection rules 
do not apply to personal information that is 
maintained for the purpose of creating a record 
available to the general public. 

In this case, it was our view that since the 
information in question could be obtained by any 
member of the public under the Municipal Act and 
since the township maintained this information to 
create a public record, section 27 was applicable. 
Therefore, the privacy protection provisions of 
section 32 of the Act did not apply. (Investigation 
194-059M) 


MEDICAL CERTIFICATE NECESSARY 


Referring to her history of disruptive behaviour at 
work and her inability to work with her colleagues, 
a municipality required an employee to obtain a 
medical certificate from her doctor attesting to her 
psychological and emotional competence. The 
employee refused to comply and in a complaint to 
the IPC, she questioned the municipality’s author- 
ity to collect the personal information in the 
certificate. 

The municipality submitted that the request for 
the certificate was necessary to the proper adminis- 
tration of a lawfully authorized activity, namely, to 
carry out its role in managing its staff. The munici- 
pality also cited a clause in the collective agreement 
relevant to the complaint which stated that where 
an employee has a poor performance or attendance 
record and it appears there may be a medical 
problem, the employee may be required to submit 
to a medical examination. 

It was our view that in certain limited circum- 
stances such as found in this case, the collection of 
a medical certificate would be necessary to the man- 
agement of staff, and would thus be in compliance 
with the municipal Act. (Investigation 195-033M) 


Indirect Collection Authorized 


Under the Acts, personal information is only to be 
collected directly from the individual to whom it 
relates, with limited exceptions. The Commis- 
sioner has the power to authorize indirect collec- 
tion in appropriate circumstances. 

This year the IPC approved eight requests for 
indirect collection and received two others which 
were withdrawn. Of those approved, four per- 
tained to Workplace Harassment Prevention 
Programs, two involved creation of wandering 
patient registries with the police, and two dealt 
with internal investigations. 


Anonymous Transactions 


Now Feasible 


The IPC and the Dutch Data Protection Author- 
ity, the Registratiekamer, collaborated this year on 
what we believe is the first joint international study 
by two organizations with the mandate of protect- 
ing privacy in their own jurisdictions. The project 
was based on our shared conviction that minimiz- 
ing personally identifying data would substantially 
increase privacy, without impeding the collection 
and storage of needed information. 

The report, Privacy-Enhancing Technologies: The 
Path to Anonymity, explored privacy technologies 
that permit transactions to be conducted anony- 
mously — such as public key encryption, blind 
signatures, digital pseudonyms and trusted third 
parties. These techniques all depend on some form 
of “identity protector”, which can generate pseudo- 
identities and/or convert between pseudo and 
actual identities. The objective is to separate a 
person’s true identity from the details of his or her 
transactions and communications. 

Our analysis concluded that these privacy- 
enhancing technologies are very sound, and the 
benefits of applying them far-reaching. The project 
also included a market survey. It found that while 
few Ontario suppliers currently offered such 
products, most would consider developing them if 
the demand existed. Strong efforts should therefore 
be made to raise public awareness of the advantages 
of privacy-enhancing technologies. 


SAFEGUARDING PERSONAL INFORMATION 


Protecting Privacy on Highway 407 


Highway 407 under construction north of Toronto 
will be one of the world’s first fully electronic, non- 
stop toll roads. Tolls will be collected using either a 
small electronic transponder attached to the vehi- 
cle, or a licence plate recognition system involving 
digital photographs. In either case, the vehicle 
owner will be charged for the tolls levied, poten- 
tially leaving a data trail. 

The IPC has been working co-operatively with 
the Ministry of Transportation and the Ontario 
Transportation Capital Corporation — a Crown 
agency responsible for the highway’s development 
— to create a payment option that would allow 
drivers to travel anonymously. For example, a 
transponder tag could be charged up like a cash 
card before entering the highway, with electronic 
deductions made for the distance travelled. This 
would require no identifiable data to be left 


behind. 


Another issue concerns the Ministry of Trans- 
portation’s vehicle database, which contains vast 
holdings of personal information. The names and 
addresses of vehicle owners will be extracted from 
this database for toll collection under the licence 
plate recognition system. We are working to ensure 
that adequate security and privacy controls are in 
place, so that this information is used only for 
billing purposes. 


Data Sharing Fraught 
with Privacy Risks 


Government organizations sometimes share per- 
sonal information, for example, to identify indivi- 
duals who are improperly receiving services from 
more than one organization. The IPC believes data 
containing personal information should be shared 
only as a last resort, after considering all practical 
alternatives. 

Data sharing by its nature raises privacy con- 
cerns, since it involves collecting personal informa- 
tion indirectly, rather than directly from the 
individuals to whom it relates. In addition, the 
data may well be used for a purpose not intended 
at the time it was originally collected. 
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MODEL AGREEMENT 


Where data sharing does take place, the IPC 
stresses it should be supported by a written agree- 
ment to clarify the rights and obligations of all 
parties, thereby ensuring compliance with the Acts. 
An IPC survey in 1994 found that while many 
government organizations routinely share personal 
information or are contemplating doing so, in 
most cases the data sharing arrangements have not 
been formalized. 

To assist government organizations, the IPC this 
year developed a Model Data Sharing Agreement. 
This document outlines the minimum issues to be 
considered when an organization contemplates 
data sharing, and suggests wording to use for the 
text of the agreement. 


LINK TO FEDERAL DATABASE 


A municipality asked the IPC to comment on a 
proposed electronic access pilot project with the 
federal government and on a draft memorandum 
of understanding between the two. The project 
allows selected municipal staff to view personal 
information accessible via a federal database. 

We found that the memorandum of understand- 
ing by and large addressed the privacy provisions of 
the municipal Act. However, it did not spell out 
the frequency of the data exchange or the medium 
to be used. We also suggested a number of opera- 
tional changes in the pilot project to ensure that 
only authorized individuals could view the ex- 
changed personal information. 


Examining Government 
Privacy Practices 


To ensure compliance with the Acts, the IPC 
reviews the data protection systems of selected 
government organizations. We also comment on 
specific practices and activities of government 
organizations that raise privacy issues. 


EMPLOYEE INFORMATION SECURE 


The IPC reviewed procedures for access to em- 
ployee-related personal information at the Munici- 
pality of Metropolitan Toronto. The organization 
passed with flying colours. We found that only 
authorized individuals had access to employee 
information, and the municipality had defined, 
documented and implemented reasonable measures 
to prevent unauthorized access. We observed that 
staff were well aware of the access and privacy 
provisions of the municipal Act, understood the 
importance of protecting employee information 
and attributed their knowledge to training pro- 
vided by the Corporate Access and Privacy Office. 


FAMILY BENEFITS FORM REVISED 


We examined a Family Benefits form used by the 
Ministry of Community and Social Services under 
the Family Benefits Act. To confirm the marital 
status of an applicant for the allowance, the Minis- 
try had sent a copy of the form to her husband. 
The form contained the applicant’s current address 
and telephone number. 

The IPC found the disclosure to be contrary to 
the provincial Act. The Ministry is in the process of 
revising the form. 


MACDONALD BLOCK 
UNDER VIDEO SURVEILLANCE 


Following an assault in a public washroom in the 
Macdonald Block at Queen’s Park, the Ministry of 
the Solicitor General and Correctional Services in 
early 1995 installed a network of video surveillance 
cameras in the complex. The IPC reviewed the 
operation of the system to ensure that its use 
complied with the provincial Act. 

We found that the collection of personal infor- 
mation on videotape was necessary for the lawfully 
authorized activity of protecting the public, per- 
sonnel and assets. However, no notice of collection 
was being given and we recommended that the 


Ministry post such notice at all entrances to the 
areas under surveillance. 

We also called on the Ministry to develop 
written policies and procedures regarding security, 
control and access to the video equipment and 
tapes, and to communicate them to all security 
personnel. These procedures should include criteria 
for defining an incident that would warrant use of 
the tapes. In addition, the tapes should be secured 
in a lockable cabinet to prevent unauthorized 
access. 


SCHOOL PREMISES MONITORED 


The IPC examined a school board’s use of video 
surveillance equipment to monitor the premises of 
a particular school. As a result of our inquiries, the 
board is developing detailed policies and proce- 
dures; a draft version will be sent to the IPC for 
comment. The board has held meetings with 
parents, students, staff and police regarding use of 
the system. 


IPC PASSES OWN TEST 


This year the IPC conducted a review of our own 
internal information security procedures. We 
concentrated on areas where electronic methods are 
used to process, transmit and store personal infor- 
mation, ranging from the fax machine to e-mail to 
remote dialling into our computer system. 

We found that our practices and procedures 
meet the privacy requirements of the Acts. Indivi- 
duals have access only to personal information they 
need in the performance of their duties, and 
personal information is adequately protected from 
inadvertent disclosure or destruction. The exercise 
served as a test run for a review process we plan to 
conduct in other organizations. 
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The IPC conducts research, raises issues for public 
debate and comments on the access and privacy — 
implications of government activities and legisla- 
tion. We keep abreast of trends in information 
management and data protection as a basis for 
recommending changes in Ontario’s policies and 
practices. In addition, we develop practical sugges- 
tions for government organizations on how to meet 
their responsibilities under the Acts — advice which 
is often relevant to the private sector as well. 


On the Legislative Front 


The new provincial government, which took office 
in June 1995, introduced amendments to Ontario’s 
freedom of information and protection of privacy 
laws during the fall session of the Legislature. The 
changes were part of two larger bills — Bill 7, the 
Labour Reform Act and Bill 26, the Savings and 
Restructuring Act (also known as the Omnibus 
Bill). The IPC provided comments on the pro- 
posed access and privacy provisions to the legisla- 
tive committees. 

The IPC was very pleased with the Minister of 
Health’s commitment to develop specific legisla- 
tion to protect the privacy of health care informa- 
tion. The IPC has long advocated such a compre- 
hensive health privacy law to ensure that Ontario 
residents are second to none when it comes to the 
confidentiality of their health information. 


Providing Comment 
on Government Programs 


The IPC had the opportunity to provide comment 
on several government programs during 1995. In 
the early part of the year the IPC worked with the 
Ministry of the Solicitor General and Correctional 
Services to strengthen various privacy features of 
the photo radar program. These included narrow- 
ing the size of the picture used to only include 
relevant information, limiting photo-enhancing 
techniques to only the plate portion of the photo 


and establishing procedures to restrict access to the 
database of photo radar images. The IPC also 
worked with the Ministry of Health by providing 
comments on the system to collect digitized photos 
and signatures for the new health card. 

The IPC reviewed and commented on revisions 
to a Management Board Secretariat directive and 
accompanying set of guidelines dealing with 
managing intellectual property rights for govern- 
ment materials. The IPC’s aim was to ensure that 
access to government-produced information would 
be maintained. 


Access Ramps 
to the Information Highway 


In March 1995 the IPC sent a submission to the 
federal Information Highway Advisory Council in 
response to its discussion paper entitled, Access, 
Affordability and Universal Service on the Canadian 
Information Highway. Our submission emphasized 
that access to the highway should be based on 
universality and equity — with governments accept- 
ing the responsibility to see that this happens. 

The principal social issue is the opportunity to 
make connections with the emerging network of 
networks. If personal connections — such as home 
computers — are not feasible, it will fall to government 
to ensure common points of connection through 
schools, libraries and other community facilities. 

In addition to access to technology, users must 
have access to the content flowing on the highway. 
Broad public education will be essential to make 
people aware of the services offered and provide the 
skills to use them. 

While many services on the highway will be 
commercial in nature, others will be judged to have 
public value — in the sense of enabling people to 
understand society better or communicate with 
government more effectively. These services must 
be widely accessible. 

As is the case with television, governments 
should encourage a strong non-profit, community- 


based and public sector presence on the informa- 
tion highway. The highway offers unparalleled 
opportunities for government organizations to 
disseminate information and consult with the 
public — opportunities that should be seized. 

How these issues are resolved will profoundly 
influence Canada’s future. Effective co-operation 
between various levels of government and the 
private sector will be essential to create the condi- 
tions that give everyone the chance to connect to 
and benefit from the information highway. 


Eyes on the Road 


The information highway is creating privacy risks 
for conventional highways. Video cameras now 
monitor traffic flow. Vehicles can be tracked by 
satellite. And a technology called automated 
vehicle identification makes it possible to plot the 
exact position of a particular vehicle at a particular 
time. 

These intelligent transportation systems (ITS) 
can be used to create travel profiles — recording 
everything from how well individuals drive to 
when they go to work and where they spend their 
leisure time. The IPC has produced a report 
entitled Eyes on the Road: Intelligent Transportation 
Systems and Your Privacy, which reviews the privacy 
risks and suggests ways to avoid them. 

The paper stresses that organizations considering 
ITS should ask themselves if it is truly necessary to 
identify individuals or their vehicles. Where collection 
of personal data is essential, privacy safeguards should 
be built into the technology and its application. 


Voice Mail Prone to Eavesdropping 


It is estimated that three out of four business calls 
are not completed on the first try, which makes 
voice mail an attractive technology. However, voice 
mail has privacy pitfalls that require attention — 
ranging from recipients who forward messages 
without the original sender’s consent, to employers 
who enter employee mailboxes. 

The IPC has published a report on Privacy 
Protection Principles for Voice Mail Systems to assist 
public and private organizations to safeguard the 


ANALYZING ISSUES AND OFFERING ADVICE 


privacy of voice mail users and those whose per- 
sonal information is sent through voice mail. 


Among the principles are the following: 


* the privacy of voice mail users should be re- 
spected and protected; 


+ all employees should receive proper education 
and training regarding how voice mail works and 
what its privacy implications are; 


* each organization should create and communi- 
cate an explicit policy on voice mail privacy — 
addressing such issues as approved uses of the 
system, third party access and enforcement; 


+ voice mail should not be used to collect, use, 
retain or disclose personal information without 
adequate privacy safeguards; 


* organizations should develop appropriate security 
procedures and pursue technological solutions for 
protecting voice mail privacy. 


National Privacy Standard 
Nears Reality 


Since 1992 the Canadian Standards Association 
(CSA) has been facilitating the development of a 
voluntary privacy code for the private sector. The 
CSA has organized a consensus process involving 
data users, data subjects, government officials and 
other interested groups. The IPC has been an 
active participant through non-voting membership 
on the committee. 

This year, the CSA released a revised draft of the 
Model Code for the Protection of Personal Informa- 
tion for a final round of public comment. The draft 
code includes 10 interrelated data protection 
principles, with commentary on each. Organiza- 
tions adopting the standard will adhere to all 10 
principles and have the option of incorporating 
them into their own codes. 

The final version of the model code will go 
forward for approval as a national standard by the 
Standards Council of Canada. Release of the 
standard is expected in early 1996. The IPC is 
continuing to participate in the work of the CSA 
committee on an implementation plan for the code. 
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The IPC maintains an active communications 
program to increase public awareness of access and 
privacy issues, promote understanding of rights 
and responsibilities under the Acts, and inform 
both consumers and government organizations of 


the IPC’s procedures. 


IPC Goes On-line 


The IPC launched a World Wide Web site on the 
Internet in November 1995 as a research, communi- 
cation and information tool. Our system includes: 


° all orders and published investigation reports, 
with the capability to download the full text to the 
user’s own computer; an index of selected orders 
and investigation reports by subject matter; and an 
index of all orders and reports by section of the Acts, 


* summaries of our policy papers with full text 
available through downloading, plus full text of key 
issues of our publication Practices and the text of 
our current newsletter, Perspectives ; 


* the text of both Acts, as well as a plain language 
guide; and 


¢ information on our role and frequently asked 
questions on access and privacy. 


Our Web site address is http://www.ipc.on.ca. 


Working with 


Government Co-ordinators 


Co-ordinators in municipal and provincial organiza- 
tions play a central role in the day-to-day operation 
of Ontario’s access and privacy system. To assist 
co-ordinators, the IPC this year took part in 17 
training sessions around the province, in co-opera- 
tion with Management Board Secretariat (MBS). 
We also co-sponsored the co-ordinators’ annual 
fall workshop in partnership with MBS and the 
Association of Municipal Clerks and Treasurers of 
Ontario. The November event — “Working Towards 
Solutions” — drew more than 200 participants to 


RAISING AWARENESS OF ACCESS AND PRIVACY 


two days of case studies, round tables and policy 
discussions. 


Outreach Campaign Continues 


The IPC’s public outreach campaign this year 
included 38 speeches by the Commissioner, Assist- 
ant Commissioners or staff members, arranged 
through the IPC Speakers’ Bureau. Among the 
various audiences reached were student groups at 
the University of Waterloo, York University, the 
University of Toronto and Humber College, 
elected officials in Haldimand-Norfolk, the 
Sudbury Community Legal Clinic, an Industry 
Canada event, a Canadian Institute conference, the 
Ontario Hospital Association and, internationally, 
the Pan Pacific Conference in Victoria, BC and the 
Connecticut Foundation for Open Government. 

We conducted province-wide media campaigns 
— with news releases and other print materials — to 
support the release of two major IPC reports: Eyes 
on the Road: Intelligent Transportation Systems and 
Your Privacy and Privacy Protection Principles for 
Voice Mail Systems. We also published three editions 
of our newsletter, Perspectives, to keep government 
organizations, business groups and the national 
and international privacy community informed of 
our activities and emerging Ontario issues. 

We released 10 new items in our Practices series 
of concise practical guides for government organi- 
zations, users of the appeals and complaints sys- 
tems or the general public. The Practices issue on 
“Privacy and Confidentiality When Working 
Outside the Office”, for example, explains how 
government employees can protect the privacy of 
personal information when working at home or in 
other non-traditional settings. It was prepared by a 
working group including municipal and provincial 
co-ordinators, MBS staff and the IPC. 

Demand remained strong for our brochures on 
the IPC and pocket guides to the Acts. In all, we 
provided more than 21 600 information pieces in 
reply to requests, and responded to more than 
4000 telephone calls from people seeking informa- 
tion on access and privacy. 


FINANCIAL STATEMENT = 


S 


tatement of Expenditure for 1995-96 1994-95 
the year ended March 31, 1996 $ $ 
Salaries and wages 5,322,992 5,455,615 
Employee benefits 894,276 628,500 
Transportation and communication 81,644 111,507 
Services 778,665 934,158 
Supplies and equipment 346,464 316,630 
Total Expenditures 7,424,041 7,446,410 


The figures for the period ending March 31, 1996 are unaudited. For a copy of the Provincial 
Auditors report please contact the IPC Communications department at 416-326-3927 or 


1-800-387-0073; TTY (Teletypewriter) 416-325-7539. 


Approved: 


LTE WRK 


Information and Privacy Commissioner 
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APPENDIX A 


As required by the Public Sector Salary Disclosure Act, 1996 the following chart shows which IPC employees 


received more than $100,000 in salary and benefits during 1995. 


Name 


Wright, Tom 


Anderson, Ken 


Cavoukian, Ann 
Challis, William 


Glasberg, Irwin 


Position 


Commissioner 


Director of Legal Services 
(on secondment as Director 
of Appeals from January to 
October 1995) 


Assistant Commissioner (Privacy) 
Legal Counsel 


Director of Appeals (on secondment 
as Assistant Commissioner (Access) 
from January to October 1995) 


Salary Paid 


$118,242.68 


$118,193.02 


$104,493.88 
$104,360.88 


$117,922.62 


Taxable Benefits 


$340.96 


$340.84 


$301.30 


$301.06 


$341.08 
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